Steps to address data spillage in the cloud (ITSAP.50.112) – Canadian Centre for Cyber Security

Summary

This Cyber Centre guidance (ITSAP.50.112) explains what data spillage is and sets out a four-step playbook for identifying, containing, alerting and remediating spills in cloud environments. It emphasises rapid detection, using platform tools and CSP support for containment, clear internal and external notification pathways (including reporting to the Cyber Centre and the Office of the Privacy Commissioner where applicable), and thorough remediation — including device replacement, crypto-shredding and policy updates. The guidance also covers broader measures to improve cloud security posture, staff awareness and proper disposal of IT media.

Key Points

Data spillage means sensitive information has been placed on systems or exposed to people not authorised to access it (for example, secret data on an unclassified network).
Step 1 — Identify: quickly triage the spill by asking what was exposed, where it moved, how and when, who received it and where it originated.
Step 2 — Contain: use cloud platform functions to delete affected files, contact recipients to stop forwarding and delete copies, and work with CSPs to seal off exposure.
Step 3 — Alert stakeholders: report internally to IT and management, use secure channels with CSPs, and notify external parties as required (including the Cyber Centre and OPC for government/critical sectors or privacy impacts).
Step 4 — Remediate: investigate root cause, engage CSPs for cleanup, crypto-shred or replace affected devices/tenant space, and update policies and procedures based on lessons learned.
Responsibility and collaboration: data owners retain legal responsibility for data in the cloud and must maintain clear agreements and cooperation with CSPs.
Prevention: regular staff training, continuous improvement of policies and robust monitoring are essential to reduce future spills.
Disposal: properly sanitise or destroy IT media to prevent residual-data exploitation (see IT media sanitization ITSP.40.006).

Why should I read this?

If your organisation uses cloud services and you handle any sensitive information, this is a practical, no-nonsense checklist you can action straightaway. It tells you what to ask when a spill happens, what to do first to stop it getting worse, who to call, and how to make sure the same mistake doesn’t happen again. Short, sharp and useful — worth a quick read and a spot on your incident playbook.

Author’s note

Punchy take: This guidance is a must-read for security teams and managers responsible for cloud data. It turns an often-chaotic incident into a set of clear, sequential steps — identify, contain, alert, remediate — and reminds organisations that cloud use doesn’t remove their responsibility for data protection.

Source

Source: https://cyber.gc.ca/en/guidance/steps-address-data-spillage-cloud-itsap50112